Generate diverse training data using adversarial augmentation.
The essential reason why an attacker can easily introduce malicious perturbations in a sample is the lack of sample diversity in each concept class. The data distribution of each concept can be discrete and highly dispersed. For example, in the CUB (birds) dataset [1]} - a sample set containing numerous different types of birds with e.g. `WingColor==Black' concept class, which would still not be enough to cover all possible combinations of birds of different sizes, shapes, etc. Hence, the distribution of `WingColor==Black' concept has huge vacancies in its domain that CBM fails to explore while malicious attacker can easily manipulate. One way to make it difficult for the attacker to exploit such `vacancies' in data distribution (previously unexplored by CBMs) is to augment the training set by injecting diverse training samples which smoothen the concept distribution space. Intuitively, it simulates a weak attacker and generates images that look perceptually similar - but with potentially different concept classes which in turn, significantly enriches the spectrum of concepts existing in the training data.
